Huge Security Concern with Tsu (New Social Network 7MM Investment)

2 points by jancoast ↗ HN
So you guys probably have heard something about Tsu.co by now, the social network that has recently received 7 million in funding, which pays it's users a portion of the ad money it receives based on independent viewership much like the revenue sharing model you see with Youtube. Anyway you can find out all about it at http://tsu.co/faq, since their main site is horrible at explaining anything about the actual project.

Anyway here's the fun part...

So I decided to try it out, feel free to register using the "invite link" below (it's invite only right now), just don't use a password you use for anything else... http://tsu.co/dragmecom

Here's why...

Take a look when you're registering, notice how there's no SSL? Haha you guessed it, all of their information throughout the entire site is completely unencrypted. That means all passwords, emails, user addresses, etc. are unencrypted and visible to anyone and everyone.

You don't need to be a security expert to know this, it's almost text book knowledge for anyone who has ever interfaced with the web on a technical level. Soooooo my fellow hacker news friends, enjoy this new found information.

Maybe one of you might be so encouraged to post, "I love good security" via the founder's account. I tried to email the staff about the concern but still haven't received a response, maybe you all can "encourage" them to expedite patching this crucial security concern, and protect their users.

Happy cracking! :)

13 comments

[ 5.2 ms ] story [ 33.5 ms ] thread
Thanks for the heads up, it can't be something that big (at least based on funding) dedicates such poor attention to security... it's really a bit weird.
Don't act like this isn't your startup: https://news.ycombinator.com/item?id=8499841

EDIT: May have been premature, but it is still suspicious.

Don't act like you are burning in ENVY.

It's not my startup and I'm not even remotely connected to it (like the pun?). I just submitted a link about it. Chill.

I can assure you he has no relation to Tsu.
You're welcome. That's what happens when rookies develop MVPs.
I'm not sure a rookie could build a social network platform together with a distributed revenue system on top of it, without having ever been exposed to what SSL is, because that'd be the only excuse for not implementing it, unless they are really doing this to make people talk about them.
Just to update looks like they took my concerns into consideration.